git-cli-scanner 1.1.5 → 1.2.0

package/dist/cli.js

@@ -69,32 +69,44 @@ var init_apiKeys = __esm({
       {
         id: "stripe-key",
         description: "Stripe Secret/Restricted Key",
-        pattern: /(?:sk|rk)_(?:test|live)_[0-9a-zA-Z]{24}/
+        pattern: /(?:sk|rk)_(?:test|live)_[0-9a-zA-Z]{24}/,
+        risk: "An attacker can issue unauthorized refunds, access customer payment data, or disrupt billing operations.",
+        solution: "Revoke in Stripe Dashboard (Developers > API keys). Use a secret manager (e.g. AWS Secrets Manager, Doppler) or .env files, and load via process.env."
       },
       {
         id: "sendgrid-key",
         description: "SendGrid API Key",
-        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/,
+        risk: "Allows unauthorized sending of emails from your domains, leading to phishing campaigns and domain blacklisting.",
+        solution: "Revoke in Twilio SendGrid UI (Settings > API Keys). Store the new key securely using environment variables."
       },
       {
         id: "mailgun-key",
         description: "Mailgun API Key",
-        pattern: /key-[0-9a-zA-Z]{32}/
+        pattern: /key-[0-9a-zA-Z]{32}/,
+        risk: "Allows an attacker to read incoming emails, send spam, and permanently ruin your email domain reputation.",
+        solution: "Rotate the key immediately in Mailgun Settings. Hardcoded Mailgun keys can lead to severe email spoofing and domain reputation loss."
       },
       {
         id: "twilio-key",
         description: "Twilio API Key",
-        pattern: /SK[0-9a-fA-F]{32}/
+        pattern: /SK[0-9a-fA-F]{32}/,
+        risk: "Attackers can incur massive financial charges via SMS toll fraud or hijack phone numbers.",
+        solution: "Delete this key in the Twilio Console (Account > API keys & tokens). Never hardcode communication API keys."
       },
       {
         id: "generic-api-key",
         description: "Generic API Key / Secret / Password / Passphrase",
-        pattern: /(?:api[_\-]?key|secret|token|password|pwd|passphrase)[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i
+        pattern: /(?:api[_\-]?key|secret|token|password|pwd|passphrase)[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i,
+        risk: "Generic secrets often grant unrestricted access to databases, third-party APIs, or internal microservices.",
+        solution: "Extract this secret into a local .env file. Ensure .env is added to your .gitignore so it never enters source control."
       },
       {
         id: "generic-bearer-token",
         description: "Generic Bearer Token",
-        pattern: /bearer\s+[a-zA-Z0-9\-_.]{20,}/i
+        pattern: /bearer\s+[a-zA-Z0-9\-_.]{20,}/i,
+        risk: "Bearer tokens allow impersonation of users or service accounts to access protected REST APIs directly.",
+        solution: "Bearer tokens grant direct access to APIs. Remove it from code, revoke the session, and inject it securely at runtime."
       }
     ];
     apiKeyScanner = {
@@ -114,7 +126,8 @@ var init_apiKeys = __esm({
                   line: lineNumber,
                   match: cleanLine.trim().substring(0, 50) + "...",
                   severity: "high",
-                  solution: "Store this key in a secret manager or environment variable. Never hardcode it."
+                  solution: rule.solution,
+                  risk: rule.risk
                 });
               }
             }
@@ -136,17 +149,23 @@ var init_cloudProviders = __esm({
       {
         id: "aws-access-key",
         description: "AWS Access Key ID",
-        pattern: /(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/
+        pattern: /(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/,
+        risk: "An attacker can use this to spin up thousands of crypto-mining EC2 instances, costing you massive amounts of money.",
+        solution: "Deactivate the key in AWS IAM Console immediately. Switch to using short-lived credentials via AWS STS or IAM Roles whenever possible."
       },
       {
         id: "aws-secret-key",
         description: "AWS Secret Access Key (heuristics)",
-        pattern: /aws_?(?:secret)?_?(?:access)?_?key[\s:=]+["'][a-zA-Z0-9\/+]{40}["']/i
+        pattern: /aws_?(?:secret)?_?(?:access)?_?key[\s:=]+["'][a-zA-Z0-9\/+]{40}["']/i,
+        risk: "Compromised AWS Secret Keys grant direct access to your entire cloud infrastructure, databases, and storage buckets.",
+        solution: "This secret grants access to your AWS infrastructure. Remove it from the codebase and inject it using a secure CI/CD secrets manager or HashiCorp Vault."
       },
       {
         id: "gcp-api-key",
         description: "Google Cloud API Key",
-        pattern: /AIza[0-9A-Za-z\-_]{35}/
+        pattern: /AIza[0-9A-Za-z\-_]{35}/,
+        risk: "Attackers can bypass quotas to abuse GCP services like Maps API or Vertex AI, causing high billing charges.",
+        solution: "Restrict the key in Google Cloud Console (APIs & Services > Credentials) to specific IP addresses/apps, or revoke it and use GCP Service Accounts."
       }
     ];
     cloudProviderScanner = {
@@ -166,7 +185,8 @@ var init_cloudProviders = __esm({
                   line: lineNumber,
                   match: cleanLine.trim().substring(0, 50) + "...",
                   severity: "high",
-                  solution: "Move this cloud credential to IAM roles, Vault, or environment variables."
+                  solution: rule.solution,
+                  risk: rule.risk
                 });
               }
             }
@@ -188,22 +208,30 @@ var init_collaboration = __esm({
       {
         id: "github-pat",
         description: "GitHub Personal Access Token",
-        pattern: /ghp_[a-zA-Z0-9]{36}/
+        pattern: /ghp_[a-zA-Z0-9]{36}/,
+        risk: "Attackers can read, modify, or delete your entire private source code and infrastructure configurations.",
+        solution: "Revoke this token immediately in your GitHub Developer Settings. For automated workflows, use a fine-grained PAT or GitHub Apps."
       },
       {
         id: "github-oauth",
         description: "GitHub OAuth Access Token",
-        pattern: /gho_[a-zA-Z0-9]{36}/
+        pattern: /gho_[a-zA-Z0-9]{36}/,
+        risk: "Grants third-party level access to GitHub accounts, leading to source code theft or supply chain attacks.",
+        solution: "Revoke the OAuth token via GitHub Settings > Authorized OAuth Apps. Never hardcode OAuth tokens."
       },
       {
         id: "slack-token",
         description: "Slack Token",
-        pattern: /xox[pboar]-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{32}/
+        pattern: /xox[pboar]-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{32}/,
+        risk: "An attacker can read private messages, extract company secrets, and socially engineer employees using internal channels.",
+        solution: "Regenerate the Slack App Token in your Slack API Dashboard. If pushed, an attacker can access your internal team communications."
       },
       {
         id: "slack-webhook",
         description: "Slack Webhook",
-        pattern: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8,10}\/B[a-zA-Z0-9_]{8,10}\/[a-zA-Z0-9_]{24}/
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8,10}\/B[a-zA-Z0-9_]{8,10}\/[a-zA-Z0-9_]{24}/,
+        risk: "Allows unauthenticated actors to spam or spoof messages into your internal team channels.",
+        solution: "Delete the webhook in Slack and create a new one. Load the webhook URL via environment variables in production."
       }
     ];
     collaborationScanner = {
@@ -223,7 +251,8 @@ var init_collaboration = __esm({
                   line: lineNumber,
                   match: cleanLine.trim().substring(0, 50) + "...",
                   severity: "high",
-                  solution: "Use OAuth tokens or environment variables. Do not commit team tokens."
+                  solution: rule.solution,
+                  risk: rule.risk
                 });
               }
             }
@@ -245,17 +274,23 @@ var init_privateKeys = __esm({
       {
         id: "rsa-private-key",
         description: "RSA Private Key",
-        pattern: /-----BEGIN RSA PRIVATE KEY-----/
+        pattern: /-----BEGIN RSA PRIVATE KEY-----/,
+        risk: "Allows attackers to decrypt intercepted traffic, forge digital signatures, or authenticate to your infrastructure.",
+        solution: "RSA keys should never enter source control. Rotate this key on all associated servers/services and use a secure keystore like AWS KMS or HashiCorp Vault."
       },
       {
         id: "openssh-private-key",
         description: "OpenSSH Private Key",
-        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/,
+        risk: "Attackers can use this to SSH directly into your production servers, clone private repos, or pivot into your internal network.",
+        solution: "This SSH key could grant direct server access. Generate a new SSH keypair (`ssh-keygen`), replace the public key on your servers, and delete this leaked private key."
       },
       {
         id: "pgp-private-key",
         description: "PGP Private Key",
-        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/
+        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/,
+        risk: "An attacker can impersonate you to sign malicious software releases or decrypt highly sensitive PGP-encrypted messages.",
+        solution: "Revoke this PGP key via your keyserver immediately, as it can be used to forge digital signatures or decrypt sensitive payloads."
       }
     ];
     privateKeyScanner = {
@@ -275,7 +310,8 @@ var init_privateKeys = __esm({
                   line: lineNumber,
                   match: cleanLine.trim().substring(0, 50) + "...",
                   severity: "high",
-                  solution: "Never commit private keys. Revoke this key immediately if it was ever public, and use a secure key manager."
+                  solution: rule.solution,
+                  risk: rule.risk
                 });
               }
             }
@@ -330,7 +366,8 @@ var init_envFiles = __esm({
             line: 0,
             match: matchMsg,
             severity,
-            solution: "Add this file to .gitignore. If it is a template, rename it to .env.example."
+            solution: `Run 'echo "${filename}" >> .gitignore' to safely ignore this file type moving forward. If it's meant to be a template, rename it to '${filename}.example'.`,
+            risk: "Contains highly sensitive environment variables, database passwords, or SSL certificates that grant instant system access if leaked."
           });
         }
         return issues;
@@ -500,31 +537,55 @@ function error(message) {
   console.error(import_picocolors.default.red("\u2716 error ") + message);
 }
 function printIssues(issues, showSolution = false) {
+  if (issues.length === 0) return;
   console.error("\n" + import_picocolors.default.bold("Scan Results:"));
-  issues.forEach((issue) => {
-    let indicator = "\u25CF";
-    let label = "HIGH";
-    let colorFn = import_picocolors.default.red;
-    if (issue.severity === "medium") {
-      label = "MEDIUM";
-      colorFn = import_picocolors.default.yellow;
-    } else if (issue.severity === "dummy") {
-      indicator = "\u25CB";
-      label = "IGNORED (DUMMY)";
-      colorFn = import_picocolors.default.dim;
-    }
-    let displayMatch = issue.match.replace(/\n/g, " ").trim();
-    if (displayMatch.length > 60) {
-      displayMatch = displayMatch.substring(0, 57) + "...";
+  const severityWeight = { high: 3, medium: 2, dummy: 1 };
+  const sortedIssues = [...issues].sort((a, b) => {
+    return (severityWeight[b.severity] || 0) - (severityWeight[a.severity] || 0);
+  });
+  const grouped = /* @__PURE__ */ new Map();
+  for (const issue of sortedIssues) {
+    const key = `${issue.file}:::${issue.type}`;
+    if (!grouped.has(key)) {
+      grouped.set(key, []);
     }
-    console.error(`
+    grouped.get(key).push(issue);
+  }
+  for (const [key, group] of grouped.entries()) {
+    const displayCount = Math.min(group.length, 3);
+    for (let i = 0; i < displayCount; i++) {
+      const issue = group[i];
+      let indicator = "\u25CF";
+      let label = "HIGH";
+      let colorFn = import_picocolors.default.red;
+      if (issue.severity === "medium") {
+        label = "MEDIUM";
+        colorFn = import_picocolors.default.yellow;
+      } else if (issue.severity === "dummy") {
+        indicator = "\u25CB";
+        label = "IGNORED (DUMMY)";
+        colorFn = import_picocolors.default.dim;
+      }
+      let displayMatch = issue.match.replace(/\n/g, " ").trim();
+      if (displayMatch.length > 60) {
+        displayMatch = displayMatch.substring(0, 57) + "...";
+      }
+      console.error(`
   ${colorFn(indicator)} ${colorFn(import_picocolors.default.bold(label))} ${import_picocolors.default.dim("\xB7")} ${issue.type}`);
-    console.error(`    ${import_picocolors.default.dim("File:")}  ${issue.file}:${issue.line || "?"}`);
-    console.error(`    ${import_picocolors.default.dim("Match:")} ${displayMatch}`);
-    if (showSolution && issue.solution) {
-      console.error(`    ${import_picocolors.default.dim("Fix:")}   ${import_picocolors.default.green(issue.solution)}`);
+      console.error(`    ${import_picocolors.default.dim("File:")}  ${issue.file}:${issue.line || "?"}`);
+      console.error(`    ${import_picocolors.default.dim("Match:")} ${displayMatch}`);
+      if (issue.risk) {
+        console.error(`    ${import_picocolors.default.dim("Risk:")}  ${import_picocolors.default.yellow(issue.risk)}`);
+      }
+      if (showSolution && issue.solution) {
+        console.error(`    ${import_picocolors.default.dim("Fix:")}   ${import_picocolors.default.green(issue.solution)}`);
+      }
     }
-  });
+    if (group.length > 3) {
+      console.error(`
+    ${import_picocolors.default.cyan(`... and ${group.length - 3} more similar issues in ${group[0].file}`)}`);
+    }
+  }
   console.error();
 }
 var import_picocolors;
@@ -555,17 +616,40 @@ ${import_picocolors3.default.dim("  Scanning")} ${import_picocolors3.default.cya
     console.log(`
   ${import_picocolors3.default.bold(`Found ${fileIssues.length} issue(s):`)}
 `);
-    fileIssues.forEach((issue) => {
-      const severity = issue.severity === "high" ? import_picocolors3.default.red("HIGH") : issue.severity === "medium" ? import_picocolors3.default.yellow("MEDIUM") : import_picocolors3.default.dim("DUMMY");
-      const indicator = issue.severity === "dummy" ? import_picocolors3.default.dim("\u25CB") : "\u25CF";
-      console.log(`  ${indicator} ${severity} ${import_picocolors3.default.dim("\xB7")} ${issue.type}`);
-      console.log(`    ${import_picocolors3.default.dim("Line:")}  ${issue.line || "?"}`);
-      console.log(`    ${import_picocolors3.default.dim("Match:")} ${issue.match.substring(0, 60)}`);
-      if (issue.solution) {
-        console.log(`    ${import_picocolors3.default.dim("Fix:")}   ${import_picocolors3.default.green(issue.solution)}`);
-      }
-      console.log();
+    const severityWeight = { high: 3, medium: 2, dummy: 1 };
+    const sortedIssues = [...fileIssues].sort((a, b) => {
+      return (severityWeight[b.severity] || 0) - (severityWeight[a.severity] || 0);
     });
+    const grouped = /* @__PURE__ */ new Map();
+    for (const issue of sortedIssues) {
+      if (!grouped.has(issue.type)) {
+        grouped.set(issue.type, []);
+      }
+      grouped.get(issue.type).push(issue);
+    }
+    for (const [type, group] of grouped.entries()) {
+      const displayCount = Math.min(group.length, 3);
+      for (let i = 0; i < displayCount; i++) {
+        const issue = group[i];
+        const severity = issue.severity === "high" ? import_picocolors3.default.red("HIGH") : issue.severity === "medium" ? import_picocolors3.default.yellow("MEDIUM") : import_picocolors3.default.dim("DUMMY");
+        const colorFn = issue.severity === "high" ? import_picocolors3.default.red : issue.severity === "medium" ? import_picocolors3.default.yellow : import_picocolors3.default.dim;
+        const indicator = issue.severity === "dummy" ? import_picocolors3.default.dim("\u25CB") : colorFn("\u25CF");
+        console.log(`  ${indicator} ${severity} ${import_picocolors3.default.dim("\xB7")} ${issue.type}`);
+        console.log(`    ${import_picocolors3.default.dim("Line:")}  ${issue.line || "?"}`);
+        console.log(`    ${import_picocolors3.default.dim("Match:")} ${issue.match.substring(0, 60)}`);
+        if (issue.risk) {
+          console.log(`    ${import_picocolors3.default.dim("Risk:")}  ${import_picocolors3.default.yellow(issue.risk)}`);
+        }
+        if (issue.solution) {
+          console.log(`    ${import_picocolors3.default.dim("Fix:")}   ${import_picocolors3.default.green(issue.solution)}`);
+        }
+        console.log();
+      }
+      if (group.length > 3) {
+        console.log(`    ${import_picocolors3.default.cyan(`... and ${group.length - 3} more similar issues in this file.`)}
+`);
+      }
+    }
   }
 }
 function buildChoices(dirPath) {
@@ -727,7 +811,7 @@ var Spinner = class {
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
 var program = new import_commander.Command();
-program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.1.5");
+program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.2.0");
 program.command("init").description("Install pre-commit hook for automatic scanning").action(() => {
   info("Setting up pre-commit hook...");
   try {
@@ -779,16 +863,22 @@ program.command("disable").description("Remove the pre-commit hook and disable a
 program.command("scan").description("Scan staged files for vulnerabilities").option("--show-sol", "Show solutions for vulnerabilities").option("--hook", "Internal flag used when running as a git hook").action(async (options) => {
   info("Git CLI Scanner running...");
   try {
-    const spinner = new Spinner([
+    const spinnerMsgs = options.hook ? [
       "Scanning staged files for vulnerabilities...",
       "Analyzing code patterns...",
       "Checking for exposed API keys...",
+      "Thinking..."
+    ] : [
+      "Scanning entire repository for vulnerabilities...",
+      "Analyzing code patterns...",
+      "Checking for exposed API keys...",
       "Inspecting hidden files and directories...",
       "Thinking..."
-    ]);
+    ];
+    const spinner = new Spinner(spinnerMsgs);
     spinner.start();
     await new Promise((resolve2) => setTimeout(resolve2, 3e3));
-    const issues = await scanDiff();
+    const issues = options.hook ? await scanDiff() : await scanDirectory(process.cwd());
     if (issues.length > 0) {
       const blockerIssues = issues.filter((i) => i.severity !== "dummy");
       spinner.fail(`Found ${issues.length} potential vulnerabilities! (${blockerIssues.length} blockers)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.1.5",
+  "version": "1.2.0",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {